Evict idle token-bucket entries to prevent unbounded map growth

[winhowes]

Motivation

• The token_bucket rate limiter allocated a per-key tokenBucket entry and never removed it, allowing an attacker to cause unbounded memory growth by using many unique keys.
• The intent is to retain token-bucket behavior for active callers while preventing permanent growth from stale/idle keys.

Description

• Add a periodic cleanup loop in NewRateLimiter for the token_bucket strategy that creates a time.Ticker and deletes bucket entries whose last timestamp is older than the configured window (duration).
• The cleanup loop runs alongside existing reset logic and stops via the existing done channel so limiter lifecycle and Stop() behavior remain unchanged.
• Add a regression test TestTokenBucketEvictsIdleBuckets in app/ratelimiter_test.go that verifies idle token-bucket entries are evicted after the configured window.
• Modified files: app/main.go and app/ratelimiter_test.go.

Testing

• Ran the package test suite with go test ./app and all tests passed successfully.
• The new TestTokenBucketEvictsIdleBuckets was executed as part of the test run and passed.

---

Codex Task